Controlling hazards and safety in complex systems: a multi-layered part-whole approach to system safety